Post

Like, is the biggest threat to cybersecurity the mere existence of LLMs, or is it the existence of companies like OpenAI with basically unlimited resources and an incentive to create large security incidents essentially as a marketing stunt?

It's worth questioning how much of this is real, how much of this is economics (we've never had this scale of incentive pointed at finding common vulnerabilities before), how much of this is just hype. That there's a steady stream of new CVEs all the time has always been the case.

And these tools have been available for a while now, and we keep seeing these big CVEs, we see dodgy disclosures from AI companies, but what we haven't seen has been actual real-world mass exploitation that no one is prepared for. Is this just because it hasn't happened yet?

If anyone with access to a frontier model can trivially find critical vulns in something as widespread as PHP, why isn't the internet *already* on its knees?

the AI companies position would be: because we keep spending all this money to find the vulnerabilities first, then tell the maintainers so they can fix it before the people with the less-powerful open models can find them.